Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Software Development Security > Flashcards

Software Development Security Flashcards

1
Q

Scanner

A

A program that identifies known viruses and removes the viruses or repairs infected objects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Heuristic Scanner

A

A program that intelligently analyzes unknown code to identify suspicious commands and code sections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Activity Monitor

A

A program that monitors systems and programs for suspicious activity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Change detection software

A

A program that stores baseline system information and then periodically checks for suspicious changes from the baseline values.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are 2 countermeasures for a brute force attack?

A

Implement strict access controls

keep password length to a minimum of 8 characters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Code that a specific event triggers and that destroys data stored on a system’s hard disk

A

logic bomb

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Code that may simultaneously attack the book sector and the executable files of a system

A

virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Code embedded in a program and often used to promote backdoor attacks to access system resources

A

trojan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Rapidly replicating code that takes control of a system consuming vital network resources

A

worm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the purpose of software forensics in protecting system and data security?

A

To analyze code for characteristics of authorship and intent used as evidence against attackers and to minimize damage in future attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What characteristics of current software development make information security difficult?

A

Complexity of modern applications

increased sharing of code and other resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Low level languages

A

first and second generation languages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

High level languages

A

third through fifth generation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

When programming with high level languages, which factors can contribute to security weaknesses?

A

Automatic memory allocation and deallocation

A security management system with limited options

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Define hackers

A

individuals or organizations who attempt to gain unauthorized access to information systems and network resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Define crackers

A

individuals or organizations who break into computer systems by breaching security. Often a crackers motive is altruistic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the 6 types of DoS attacks?

A 
smurf and fraggle
SYN flood
teardrop
distributed DoS
DNS DoS
Cache poisoning
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Define smurf attack

A

sends ICMP packets to multiple computers which in turn reply to the single computer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Define fraggle attack

A

smurf attack which uses UDP instead of ICMP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Defenses against smurf and fraggle attacks

A

setup a firewall to block all broadcast and ICMP messages
configure all computers to drop ICMP messages
turn off the directed broadcast capability of the router
implement an IDS
Install latest patches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Define SYN flood attack

A

Waged by not sending the final ACK message

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Defenses against a SYN flood attack

A

setup a firewall to limit the number of connection requests
implement and IDS
use SYN cookies to avoid the allocation of resources to half opened connections
install latest patches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Define teardrop attack

A

exploits bug in OS routine to reassemble fragmented packets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Defenses against teardrop attack

A

merge all fragmented packets in a full packet before routing them to the target system
Implement IDS to detect fragmented packets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Defenses against DDoS attack

A

Scan the computers to identify if the attack software is installed
Access the log files on which the client attack software is installed to determine the location of the attacker
disable unused services on systems
install a firewall and IDS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Define DNS DoS

A

Attacker changes the IP of a host to a malicious host

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Defenses against DNS DoS

A

Implement a secure DNS
Update DNS version
Configure DNS servers for internal and external public records

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Define cache poisoning

A

Attacker can’t update DNS record, so false data is entered into the cache

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Defenses against cache poisoning

A

configure DNS servers
Use DNSSecurity extensions DNSSEC
Use HTTPS to validate certificate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Defenses against brute force attacks

A

Keep the password length to a min of 8 characters
lock the account after a specified number of unsuccessful attempts
implement strict access controls to reduce the occurrence of such attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Defenses against dictionary attacks

A

use one-time password authentication
Use a password policy to enforce password rotation and hard to guess passwords
cracking tools to identify weak passwords
Implement and IDS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Defenses against spoofing attacks

A

configure the firewall to discard packets that contain private addressing
avoid using reserved IP addresses
use egress in ingress filtering
Implement an IPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Defense against a buffer overflow attack

A

use the bound checking mechanism in program code to check the length of the input variable
Install latest updates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Define between the lines entry attack

A

An attacker taps the temporarily inactive terminal of a legitimate user in an unauthorized manner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Define NAK negative acknowledgement attacks

A

an attacker capitalizes on an operating system’s failure to suitably handle NAK packets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Define line disconnect attacks

A

An attacker accesses and uses the communication line of a user who is trying to terminate his communication session.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Define pseudo-flaw attacks

A

loopholes developers insert to trap attackers and track the source of an attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Define TOC/TOU attack

A

Time of Check
Time of Use
attack occurs when program checks access permissions in advance of a resource request.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Covert channel

A

a communication path that allows a process to transmit information in a way that violates system policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

File infector virus

A

attacks exe, com files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

boot sector virus

A

attacks boot sector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

multipartite

A

multi-part virus combines executable and boot sector viruses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

script virus

A

written using script languages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

encrypted virus

A

virus detection routine and encrypted virus body.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

macro virus

A

attacks documents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

polymorphic virus

A

virus body, decryption routine, mutation engine

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

companion virus

A

spawning virus creates a file of the same name in the same directory but with a different extension. The virus file will have an extension the system will open first.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Virus defenses

A

Anti-virus software
IDS
Don’t open unidentified email attachments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

For which reasons is software forensics value for protecting information security?

A

It can help identify the authors of malicious code
The information it provides can be used to strengthen protection against future attacks
It can help prove intellectual ownership and assist in the recovery of lost source code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Object Linking and Embedding

A

Links data objects into or from multiple files or sources on a computer and segregates data into interoperable components

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

eXtensible Markup Language

A

Displays the data in a standard format independently of the database or application.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

ODBC

A

Tracks the required database driver for the application and translates the application requests into database commands.

53
Q

JDBC

A

Allows you to connect to and access information from a database using java programs or ODBC

54
Q

ADO ActiveX Data Objects

A

Helps users to write programs that access relational and non-relational database.

55
Q

OLTP - Online transaction processing

A

Records all the business transactions of the organization as they occur and helps in the real-time processing of SQL transactions.

56
Q

What are the characteristics of neural networks?

A

resembles a human nervous system

processes information simultaneously

57
Q

Follows 5 main phases in sequence: changes are made only after process completion.

A

waterfall model

58
Q

A rough system is created, tested, and evaluated to discover improvement possibilities

A

prototype model

59
Q

Follows 5 sequential phases that contain planning, implementing, checking, and acting steps

A

Spiral model

60
Q

Creates a system based on logical assumptions

A

exploratory model

61
Q

previously created components are exported or modified to create a new system

A

reuse model

62
Q

4 advantages of a neural network

A

adaptive learning
self-organization
real-time operation
fault-tolerance via redundant information coding

63
Q

Expert System

A

follows rule based programming

draws an inference to derive a fact

64
Q

7 stages of SDLC

A 
project initiation
defining functional objects
defining system requirements
developing and implementing
recording and documenting
testing and evaluating
producing and installing
65
Q

Follows sequential phases that include 4 in-built steps in each phase

A

spiral

66
Q

Follows sequential steps where changes can only be made once the whole process is complete

A

waterfall

67
Q

evaluates and authorizes the system at each sequential step

A

structured programming development

68
Q

focuses on preventing inconsistencies in the initial planning so that time is saved in the testing phase

A

cleanroom

69
Q

What kind of data model stores data in blocks?

A

object oriented

70
Q

A child node has multiple parent nodes in what data model?

A

network

71
Q

A child node has only 1 parent node in what data model?

A

hierarchical

72
Q

Data is stored in tables in what data model?

A

relational

73
Q

Data is stored in multiple databases across different locations in what data model?

A

distributed

74
Q

polyinstantiation

A

an event that occurs when multiple rows in the same table have identical primary key elements but with each being distinguished by a different security level.

75
Q

Uses for polyinstantiation

A

retain the integrity of all copies of the information in a database
store confidential data at multiple locations within the database
defend against some types of inference attacks

76
Q

maintenance phase begins with constant revisions when the system is implemented in what model?

A

modified prototype

77
Q

The key objective of application security is to ensure
A. that the software is hacker proof
B. the confidentiality, integrity, and availability of data
C. accountability of software and user activity
D. prevent data theft

A

B. the confidentiality, integrity, and availability of data

78
Q

For an application security program to be effective within an organization, it is critical to
A. identify regulatory and compliance requirements
B. educate the software development organization the impact of insecure programming.
C. develop the security policy that can be enforced
D. properly test all the software that is developed by your organization for security vulnerabilities.

A

C. develop the security policy that can be enforced

79
Q

The best defense against session hijacking and man in the middle attacks is to use which of the following in the development of software
A. unique and random identification
B. use prepared statements and procedures
C. database views
D encryption

A

A. unique and random identification

80
Q

An important characteristic of bytecode is that is
A. has increased secure inherently due to sandboxing
B. manages memory operations automatically
C. is more difficult to reverse engineer
D. is faster than interpreted languages

A

D. is faster than interpreted languages

81
Q 
Two cooperating processes that simultaneously compete for a shared resource in such a way that they violate the system's security policy is commonly known as 
A. covert channel
B. denial of service
C. overt channel
D. object reuse
A

A. covert channel

82
Q 
An organization has a website with a guest book feature, where visitors to the web site can input their names and comments about the organization.  Each time the guest book page loads, a message box is prompted with the message "you have been powned' followed by redirection to a different website.  Analysis reveals that no input validation or output encoding is being performed by the web application.  This is the basis for which type of attack?
A. denial of service
B. cross site scripting
C. malicious file execution
D. injection flaws
A

B. cross site scripting

83
Q 
The art of influencing people to divulge sensitive information about themselves or their organization by either coercion or masquerading as a valid entity is known as
A. dumpster diving
B. shoulder surfing
C. phishing
D. social engineering
A

D. social engineering

84
Q 
An organization's server audit logs indicate that an employee that was terminated in the morning was still able to access certain sensitive resource on his system, on the internal network, that afternoon.  The logs indicate that the employee had logged on successfully before he was terminated but there is no record of him logging off before he was terminated.  This is an example of which type of attack?
A. Time Of Check/Time Of Use
B. Logic Bomb
C. remote-access trojans
D. phishing
A

A. Time Of Check/Time Of Use

85
Q

The most effective defense against a buffer overflow attack is
A. disallowing dynamic construction of queries
B. bounds checking
C. encoding output
D. forced garbage collection

A

B. bounds checking

86
Q

It is extremely important that as one follows a software development project, security activities are performed
A. before release to production, so that the project is not delayed
B. if a vulnerability is detected in your software
C. in each stage of the life cycle
D. when management mandates it

A

C. in each stage of the life cycle

87
Q 
Audit logs are which type of control?
A. preventative
B. detective
C. compensating
D. corrective
A

B. detective

88
Q 
Who can enforce the separation of duties by ensuring that programmers do not have access to production code?
A. operations personnel
B. software librarian
C. management
D. quality assurance personnel
A

B. software librarian

89
Q 
The technical evaluation of assurance to ensure that security requirements have been met is known as
A. accreditation
B. certification
C. validation
D. verification
A

B. certification

90
Q 
Defect prevention rather than defect removal is characteristic of which of the following software development methodology
A. CASE
B. Spiral
C. Waterfall
D. cleanroom
A

D. cleanroom

91
Q 
A security protection mechanism in which untrusted code, which is not signed is restricted from accessing system resources is known as 
A. sandboxing
B. non-repudication
C. separation of duties
D. obfuscation
A

A. sandboxing

92
Q 
A program that does not reproduce itself but pretends to be performing a legitimate action, while actually performing malicious operations in the background is the characteristic of which of the following?
A. Worms
B. trapdoor
C. virus
D. trojan
A

D. trojan

93
Q 
A plot to take insignificant pennies from a user's bank account and move them to the attacker's bank account is an example of 
A. social engineering
B. salami attack
C. pranks
D. hoaxes
A

B. salami attack

94
Q 
Role based access control to protect confidentiality of data in databases can be best achieved through the following?
A. views
B. encryption
C. hashing
D masking
A

A. views

95
Q

The two most dangerous types of attacks against databases containing disparate non-sensitive information are
A. injection and scripting
B. session hijacking and cookie poisoning
C. aggregation and inference
D. bypassing authentication and insecure cryptography

A

C. aggregation and inference

96
Q 
A property that ensures only valid or legal transactions that do not violate any user defined integrity constraints in DBMS technologies is known as
A. atomicity
B. consistency
C. isolation
D. durability
A

B. consistency

97
Q 
expert systems are comprised of a knowledge base containing modeled human experience and which of the following?
A. inference engine
B. statistical models
C. neural networks
D. roles
A

A. inference engine

98
Q

Data marts, databases, and data warehouses have distinct characteristics. Which of the following does not correctly describe a data warehouse?
A. It could increase the risk of privacy violations
B. It is developed to carry out analysis
C. It contains data from several different sources
D. It is created and used for project based tactical reasons.

A

D. It is created and used for project based tactical reasons.

99
Q

Database software should meet the requirements of what is known as the ACID test. Why should database software carry out atomic transactions, which is one requirement of the ACID test when OLTP is used?
A. So the rules for database integrity can be established
B. So that the database performs transactions as a single unit without interruption
C. To ensure that rollbacks cannot take place.
D. To prevent concurrent processes from interacting with each other.

A

B. So that the database performs transactions as a single unit without interruption

100
Q

What does the ACID stand for?

A

Atomicity
Consistency
Isolation
Durability

101
Q

What does atomicity mean in relation to database software?

A

Divide transactions into units of work and ensures that all modifications take effect or none takes effect. Either the changes are committed or the database is rolled back.

102
Q

What does consistency mean in relation to database software?

A

A transaction must follow the integrity policy developed for that particular database and ensure all data are consistent in the different database.

103
Q

What does isolation mean in relation to database software?

A

Transactions execute in isolation until completed, without interacting with other transactions. The results of the modification are not available until the transaction is completed.

104
Q

What does durability mean in relation to database software?

A

Once the transaction is verified as accurate on all systems, it is committed, and the databases cannot be rolled back.

105
Q

Lisa has learned that most databases implement concurrency controls. What is concurrency and why must it be controlled?
A. Processes running in different levels, which can negatively affect the integrity of the database if not properly controlled.
B. The ability to deduce new information from reviewing accessible data, which can allow an inference attack to take place.
C. Processes running simultaneously, which can negatively affect the integrity of the database if not properly controlled.
D. Storing data in more than one place within a database, which can negatively affect the integrity of the database if not properly controlled.

A

C. Processes running simultaneously, which can negatively affect the integrity of the database if not properly controlled.

106
Q 
What is the name of the procedure which minimizes duplication and inconsistencies?
A. Polymorphism
B. Normalization
C. Implementation of database views
D. Constructing schema
A

B. Normalization

107
Q

Which of the following correctly best describes an object-oriented database?
A. When an application queries for data, it receives both the data and the procedure.
B. It is structured similarly to a mesh network for redundancy and fast data retrieval.
C. Subject must have knowledge of the well-defined access path in order to access data.
D. The relationships between data entities provide the framework for organizing data.

A

A. When an application queries for data, it receives both the data and the procedure.

108
Q 
Fred has been told he needs to test a component of the new content management application under development to validate its data structure, logic, and boundary conditions.  What type of testing should he carry out?
A. Acceptance testing
B. Regression testing
C. Integration testing
D. Unit testing
A

D. Unit testing

109
Q

What is acceptance testing?

A

Testing to ensure code meets customer requirements.

110
Q

What is regression testing?

A

Retesting a system after a change has taken place.

111
Q

Which of the following is the best description of a component-based system development method?
A. Components periodically revisit previous stages to update and verify design requirements
B. Minimizes the use of arbitrary transfer control statements between components.
C. Uses independent and standardized modules that are assembled into serviceable programs
D. Implemented in module-based scenarios requiring adaptions to changing client requirements.

A

C. Uses independent and standardized modules that are assembled into serviceable programs

112
Q

Which of the following is not a correct description of a polymorphic virus?
A. Intercepts antivirus’s call to the operating system for file and system information.
B. Varies the sequence of its instructions using noise, a mutation engine, or random number generator.
C. Can use different encryption schemes requiring different decryption routines.
D. Produces multiple, varied copies of itself.

A

A. Intercepts antivirus’s call to the operating system for file and system information.

113
Q

Which of the following best describes the role of the Java Virtual Machine in the execution of Java applets?
A. Coverts the source code into bytecode and blocks the sandbox.
B. Coverts the bytecode into machine level code
C. Operates only on specific processors within specific operating systems
D. Develops the applets, which run in a user’s browser

A

B. Coverts the bytecode into machine level code

114
Q 
What type of database software integrity service guarantees that tuples are uniquely identified by primary key values?
A. Concurrent integrity
B. referential integrity
C. Entity integrity
D. Semantic integrity
A

C. Entity integrity

115
Q

What is referential integrity?

A

Refers to all foreign keys referencing existing primary keys.

116
Q 
In computer programming, cohesion and coupling are used to describe modules of code.  Which of the following is a favorable combination of cohesion and coupling?
A. Low cohesion, low coupling
B. High cohesion, high coupling
C. low cohesion, high coupling
D. High cohesion, low coupling
A

D. High cohesion, low coupling

117
Q

What is cohesion in software programming?

A

Reflects how many different types of tasks a module can carry out. High cohesion means a module carries out 1 basic task.

118
Q

What is coupling in software programming?

A

Reflects how much interaction one module requires to carry out its tasks.

119
Q 
When an organization is unsure of the final nature of the product, what type of system development method is most appropriate for them?
A. Cleanroom
B. Exploratory model
C. Modified prototype method
D. Iterative Development
A

C. Modified prototype method

120
Q

Which of the following statements does not correctly describe SOAP and Remote Procedure Calls?
A. SOAP was designed to overcome the compatibility and security issues associated with Remote Procedure Calls.
B. Both SOAP and Remote procedure calls were created to enable application layer communication.
C. SOAP enables the use of Remote procedure calls for information exchange between applications over the internet.
D. HTTP was not designed to work with remote procedure calls, but SOAP was designed to work with HTTP.

A

C. SOAP enables the use of Remote procedure calls for information exchange between applications over the internet.

121
Q 
Computer programs that are based on human logic by using "if/then" statements and inference engines are called
A. Expert systems
B. artificial neural networks
C. Distributed computing environment
D. Enterprise java beans
A

A. Expert systems

122
Q

Which of the following is a correct description of the pros and cons associated with third-generation programming languages?
A. The use of heuristics reduced programming effort, but the amount of manual coding fora specific task is usually more than the preceding generation.
B. The use of syntax similar to human language reduced development time, but the language is resource intensive.
C. The use of binary was extremely time consuming but resulted in fewer errors.
D. The use of symbols reduced programming time, but the language required knowledge of machine architecture.

A

B. The use of syntax similar to human language reduced development time, but the language is resource intensive.

123
Q 
Which of the following is considered the second generation of programming languages?
A. Machine
B. Very high level
C. High level
D Assembly
A

D Assembly

124
Q 
Mary is creating malicious code that will steal a user's cookies by modifying the original client-side java script.  What type of cross-site scripting vulnerability is she exploiting?
A. Second order
B. DOM-based
C. persistent
D. non-persistent
A

B. DOM-based

125
Q

Of the following steps that describe the development of a botnet, which best describes the step that comes first?
A. Infected server sends attach commands to the botnet
B. Spammer pays a hacker for use of the botnet
C. Controller server instructs infected systems to send spam to mail server.
D. Malicious code is sent out that has bot software as its payload.

A

D. Malicious code is sent out that has bot software as its payload.

126
Q 
Which of the following antivirus detection methods is the most recent to the industry and monitors suspicious code as it executes within the operating system?
A. Behavior blocking
B. fingerprint detection
C. signature based detection
D. heuristic detection
A

A. Behavior blocking

127
Q

Which of the following describes object oriented programming deferred commitment?
A. autonomous objects, which cooperate through exchanges of messages
B. The internal components of an object can be refined without changing other parts of the system
C. Object oriented analysis, design, and modeling maps to business needs and solutions
D. Other programs using same objects

A

B. The internal components of an object can be refined without changing other parts of the system

128
Q

_________ provides a machine readable description of the specific operations provided by a specific web service. ________ provides a method for web services to be registered by service providers and located by consumers.
A. Web service description language, universal description, discovery and integration
B. Universal description, discovery and integration, web services description language
C. web services description language, simple object access protocol
D. Simple Object Access Protocol

A

A. Web service description language, universal description, discovery and integration

CISSP (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions